Easily bypassed patch makes zero-click Outlook flaw exploitable again (CVE-2023-29324)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-23397 | Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak) CVE-2023-23397 is an elevation of privilege vulnerability in Microsoft Outlook caused by improper input validation (CWE-20) combined with authentication bypass via spoofed authentication data on the channel (CWE-294), allowing an attacker to force Outlook to authenticate to an attacker-controlled SMB/WebDAV server. It is triggered when Outlook processes a crafted email or calendar object — for example a meeting or task reminder whose sound property points to an attacker-supplied UNC path — and requires no user interaction. That authentication exchange leaks the victim's NTLM credential hash, which the attacker can crack offline or relay to authenticate as the victim and access resources such as Exchange mailboxes, effectively escalating privileges. Affected software spans Microsoft 365 Apps, Microsoft Office (including the Long Term Servicing Channel), and Microsoft Outlook, which are deployed across enterprises, governments, and militaries worldwide. It is actively exploited in the wild — added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-14 with a 97.4% EPSS — and Microsoft has warned of exploitation by Russia-aligned threat actors in campaigns against government and military mail servers, with patches shipped in Microsoft's March 2023 security updates. Do: Apply Microsoft's March 2023 security updates to Microsoft 365 Apps, Office/LTSC, and Outlook immediately, per CISA's required action. As interim mitigation, enable Extended Protection for Authentication or add accounts to the Protected Users group to block the NTLM credential leak, and audit calendar and task reminder sound properties for UNC paths (Microsoft published an audit/cleanup script for this) while watching for unexpected outbound SMB/WebDAV connections from hosts running Outlook. | 9.8 | 97% | KEV |
| masson the order of hundreds of millions of users (Outlook ships with Microsoft Office/Microsoft 365, the dominant enterprise and government email suite) | |
| CVE-2023-29324 | Windows MSHTML Platform Security Feature Bypass Vulnerability Windows MSHTML Platform Security Feature Bypass Vulnerability NVD description · AI analysis pending | 6.5 | 3% |
| — |
Full article452 words · extracted from helpnetsecurity.com · click to collapse
Among the vulnerabilities fixed by Microsoft on May 2023 Patch Tuesday is CVE-2023-29324, a bug in the Windows MSHTML platform that Microsoft rates as “important.”
Akamai’s research team and Ben Barnea, the researcher who’s credited with finding the flaw, disagree with that assessment, because “the new vulnerability [CVE-2023-29324] re-enables the exploitation of a critical vulnerability [CVE-2023-23397] that was seen in the wild and used by APT operators.”
About CVE-2023-23397
CVE-2023-23397 is an EoP bug in Microsoft Outlook that can be triggered without user interaction (aka “zero-click”).
“External attackers could send specially crafted emails that will cause a connection from the victim to an untrusted location of attackers’ control. This will leak the Net-NTLMv2 hash of the victim to the untrusted network which an attacker can then relay to another service and authenticate as the victim,” Microsoft explained in March 2023, when it provided a fix.
The email doesn’t have to be viewed or previewed by the user for the exploit to work – it just needs to be retrieved and processed by the Outlook client.
The vulnerability was reported by the Ukrainian CERT and Microsoft’s Incident and Treat Intelligence teams, after they discovered it getting exploited by a threat actor by sending out an email containing a reminder with a custom notification sound.
About CVE-2023-29324
CVE-2023-29324, on the other hand, is defined as a security feature bypass vulnerability that, according to Akamai researchers, could still have the same consequences as the critical original Outlook bug.
They discovered it when they analyzed the patch for CVE-2023-23397, which fixed the issue by changing the code flow in Outlook so that it now first checks whether the universal naming convention (UNC) path that retrieves the custom sound file refers to an internet URL and, if it does, it uses the default reminder sound instead of the custom one.
Unfortunately, they also found that that check (and consequently the patch) can be easily be borked by adding a single character that will change how a specific function categorizes the zone of the UNC path.
“This vulnerability is yet another example of patch scrutinizing leading to new vulnerabilities and bypasses,” they noted, and said that they hope Microsoft will fully remove the custom reminder sound feature, as it poses more security risks than it provides value to users.
“It is a zero-click media parsing attack surface that could potentially contain critical memory corruption vulnerabilities. Considering how ubiquitous Windows is, eliminating an attack surface as ripe as this is could have some very positive effects.”
In the meantime, the risk of exploitation of both CVE-2023-23397 and CVE-2023-29324 can be removed by implementing the patches, in that order. For more specific information, you should consult Microsoft’s security advisories.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/05/10/cve-2023-29324/